There are two things that are rapidly becoming negligent not to offer: - 2FA (mobile, yubikey, duo) - basic monitoring and notification when login patterns ch

There are two things that are rapidly becoming negligent not to offer: - 2FA (mobile, yubikey, duo) - basic monitoring and notification when login patterns change These are both relatively simple and effective. You needn't force 2FA, but please offer it. A password I shared across a couple of test accounts for various services was compromised when one of the sites storing cleartext passwords was popped. A Microsoft account was the winner of the day - they notified me that a login from $home followed by a login from Brazil looked suspicious, and they were correct. This is basic and often effective.